[HIGH]2025-06-21Malware Analysis
Signed MSI sideload RAT analysis
> Memory forensics notes on a signed MSI delivering shellcode via DLL sideload.
RATSideloadYARA
Dropper used a legitimate signed host EXE with a malicious sibling DLL.
Second stage decrypted C2 config from .rsrc using a rolling XOR key.
YARA + Sigma rules published under the BLACK ICE operation pack.